SFTPStream: stricter object value checks

mscdex · Jul 17, 2019 · e289238 · e289238
1 parent 0de75c7
commit e289238
Showing 1 changed file with 15 additions and 11 deletions.
diff --git a/lib/sftp.js b/lib/sftp.js
@@ -785,7 +785,7 @@ SFTPStream.prototype.open = function(path, flags_, attrs, cb) {
   if (typeof attrs === 'string' || typeof attrs === 'number') {
     attrs = { mode: attrs };
   }
-  if (typeof attrs === 'object') {
+  if (typeof attrs === 'object' && attrs !== null) {
     attrs = attrsToBytes(attrs);
     attrFlags = attrs.flags;
     attrBytes = attrs.nbytes;
@@ -999,7 +999,7 @@ function fastXfer(src, dst, srcPath, dstPath, opts, cb) {
 
   if (typeof opts === 'function') {
     cb = opts;
-  } else if (typeof opts === 'object') {
+  } else if (typeof opts === 'object' && opts !== null) {
     if (typeof opts.concurrency === 'number'
         && opts.concurrency > 0
         && !isNaN(opts.concurrency))
@@ -1526,7 +1526,7 @@ SFTPStream.prototype.mkdir = function(path, attrs, cb) {
     cb = attrs;
     attrs = undefined;
   }
-  if (typeof attrs === 'object') {
+  if (typeof attrs === 'object' && attrs !== null) {
     attrs = attrsToBytes(attrs);
     flags = attrs.flags;
     attrBytes = attrs.nbytes;
@@ -1600,7 +1600,7 @@ SFTPStream.prototype.readdir = function(where, opts, cb) {
     cb = opts;
     opts = {};
   }
-  if (typeof opts !== 'object')
+  if (typeof opts !== 'object' || opts === null)
     opts = {};
 
   doFilter = (opts && opts.full ? false : true);
@@ -1793,7 +1793,7 @@ SFTPStream.prototype.setstat = function(path, attrs, cb) {
   var attrBytes = 0;
   var state = this._state;
 
-  if (typeof attrs === 'object') {
+  if (typeof attrs === 'object' && attrs !== null) {
     attrs = attrsToBytes(attrs);
     flags = attrs.flags;
     attrBytes = attrs.nbytes;
@@ -1840,7 +1840,7 @@ SFTPStream.prototype.fsetstat = function(handle, attrs, cb) {
   var attrBytes = 0;
   var state = this._state;
 
-  if (typeof attrs === 'object') {
+  if (typeof attrs === 'object' && attrs !== null) {
     attrs = attrsToBytes(attrs);
     flags = attrs.flags;
     attrBytes = attrs.nbytes;
@@ -2296,10 +2296,11 @@ SFTPStream.prototype.name = function(id, names) {
   if (!this.server)
     throw new Error('Server-only method called in client mode');
 
-  if (!Array.isArray(names) && typeof names === 'object')
+  if (!Array.isArray(names)) {
+    if (typeof names !== 'object' || names === null)
+      throw new Error('names is not an object or array');
     names = [ names ];
-  else if (!Array.isArray(names))
-    throw new Error('names is not an object or array');
+  }
 
   var count = names.length;
   var namesLen = 0;
@@ -2328,7 +2329,7 @@ SFTPStream.prototype.name = function(id, names) {
                 : name.longname);
     namesLen += 4 + Buffer.byteLength(longname);
 
-    if (typeof name.attrs === 'object') {
+    if (typeof name.attrs === 'object' && name.attrs !== null) {
       nameAttrs = attrsToBytes(name.attrs);
       namesLen += 4 + nameAttrs.nbytes;
       attrs.push(nameAttrs);
@@ -2396,7 +2397,7 @@ SFTPStream.prototype.attrs = function(id, attrs) {
   if (!this.server)
     throw new Error('Server-only method called in client mode');
 
-  if (typeof attrs !== 'object')
+  if (typeof attrs !== 'object' || attrs === null)
     throw new Error('attrs is not an object');
 
   var info = attrsToBytes(attrs);
@@ -2527,6 +2528,9 @@ function attrsToBytes(attrs) {
   var ret = [];
   var i = 0;
 
+  if (typeof attrs !== 'object' || attrs === null)
+    return { flags: flags, nbytes: attrBytes, bytes: ret };
+
   if (typeof attrs.size === 'number') {
     flags |= ATTR.SIZE;
     attrBytes += 8;